Network operators deploy NAC products with the expectation that some legitimate clients will be denied access to the network (if users never had out-of-date patch levels, NAC would be unnecessary). Because of this, NAC solutions require a mechanism to remediate the end-user problems that deny them access. Two common strategies for remediation are quarantine networks and captive portals: Quarantine A quarantine network is a restricted IP network that provides users with routed access only to certain hosts and applications. Quarantine is often implemented in terms of VLAN assignment; when a NAC product determines that an end-user is out-of-date, their switch port is assigned to a VLAN that is routed only to patch and update servers, not to the rest of the network. Other solutions use Address Management techniques (such as Address Resolution Protocol (ARP) or Neighbor Discovery Protocol (NDP)) for quarantine, avoiding the overhead of managing quarantine VLANs. Captive portals A captive portal intercepts HTTP access to web pages, redirecting users to a web application that provides instructions and tools for updating their computer. Until their computer passes automated inspection, no network usage besides the captive portal is allowed. This is similar to the way paid wireless access works at public access points. External Captive Portals allow organizations to offload wireless controllers and switches from hosting web portals. A single external portal hosted by a NAC appliance for wireless and wired authentication eliminates the need to create multiple portals, and consolidates policy management processes. Mobile NAC Using NAC in a mobile deployment, where workers connect over various wireless networks throughout the workday, involves challenges that are not present in a wired LAN environment. When a user is denied access because of a security concern, productive use of the device is lost, which can impact the ability to complete a job or serve a customer. In addition, automated remediation that takes only seconds on a wired connection may take minutes over a slower wireless data connection, bogging down the device. A mobile NAC solution gives system administrators greater control over whether, when and how to remediate the security concern. A lower-grade concern such as out-of-date antivirus signatures may result in a simple warning to the user, while more serious issues may result in quarantining the device. Policies may be set so that automated remediation, such as pushing out and applying security patches and updates, is withheld until the device is connected